---
title: "JIT Sessions report"
slug: "pam-session-jit-sessions"
updated: 2026-11-03T14:47:49Z
published: 2026-11-03T14:47:49Z
canonical: "docs.senhasegura.io/pam-session-jit-sessions"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt
> Use this file to discover all available pages before exploring further.

# JIT Sessions report

This document provides information about the **JIT Sessions** report, which displays the just-in-time (JIT) accesses granted for privileged sessions. For each access, the report shows the user, the device, and the operations that provisioned and removed it. When Segura™ released the access automatically, the report also shows why. More information in [JIT credential models and session lifecycle](/v4-2/docs/pam-credential-jit-models-and-session-lifecycle).

## Path to access

1. On Segura™ Platform, in the navigation bar, hover over the **Products menu** and select **PAM Core**.
2. In the side menu, select **Audit > Sessions > JIT Sessions**.

To view the report, your access profile needs the same permission as the **Remote sessions** report. To open the provisioning and deprovisioning operations from the report, it also needs access to the operations in **Executions**.

## Search fields

| Item | Type | Description |
| --- | --- | --- |
| **User** | Text field | Filters by the user who requested the access. |
| **Device** | Text field | Filters by the device of the session. |
| **Credential** | Text field | Filters by the JIT credential. |
| **Only active sessions** | Dropdown menu | Shows only accesses whose session is in progress. The options are **Yes** and **No**. The default is **No**. |
| **Provisioning operation** | Dropdown menu | Filters by the status of the operation that granted the access. |
| **Deprovisioning operation** | Dropdown menu | Filters by the status of the operation that removed the access. |
| **Session date** | Date picker | Filters by the session date range. The default is the current day. |

## Report fields

| Column | Description |
| --- | --- |
| **ID** | Identification code of the JIT access. |
| **User** | User who requested the access. |
| **Device** | Device of the session. |
| **Credential** | JIT credential used in the session. |
| **Start** | Date and time the session started. |
| **End** | Date and time the session ended. |
| **Session status** | **In progress** or **Finished**. |
| **Provisioning operation** | Operation that created the ephemeral credential or granted the privilege. |
| **Creation executor device** | Device that ran the provisioning automation. |
| **Deprovisioning operation** | Operation that removed the ephemeral credential or revoked the privilege. |
| **Removal executor device** | Device that ran the deprovisioning automation. |
| **Reconciled at** | Date and time when Segura™ released the access automatically. |
| **Reconciliation reason** | Why Segura™ released the access. See [Reconciliation reasons](/docs/pam-session-jit-sessions#reconciliation-reasons). |
| **Actions** | **Session** opens the session. **View provisioning operation** and **View deprovisioning operation** open the matching operation in **Executions**. |

The **Actions** menu at the top of the report offers **Print report**, **Export CSV**, and **Schedule report**.

## Reconciliation reasons

Segura™ releases a JIT access that is no longer in use in two situations:

- An automatic check runs every 5 minutes. It releases an access 30 minutes after its session ends or expires. If no session was opened, it releases the access 30 minutes after provisioning was scheduled.
- A new session request releases the requester's previous access at once, without waiting 30 minutes. With **Privilege grant**, a new request can also replace another user's open access.

Segura™ never releases an access while its session is in progress, while its provisioning can still run, or while its removal is pending.

| Reason | When it is recorded |
| --- | --- |
| **Abandoned before the session** | The access never got a session, and its removal was not triggered. |
| **Session never started** | The access got a session that never started, and its removal was not triggered. |
| **Removal not triggered** | The session ended, but the removal operation was never triggered. |
| **Removal cancelled** | The removal operation was canceled or expired. Segura™ schedules the removal again. |
| **Removal task lost** | The removal operation stayed scheduled, or running, for 30 minutes without a new attempt. Segura™ schedules the removal again. |
| **Removal result not recorded** | The removal operation finished, successfully or with an error, but the access did not record the result. Segura™ closes the access with that result. |
| **Replaced by a new session** | **Privilege grant** only. A user started a session with the same credential, on the same device when the credential uses **Target device**. Another user's access, or an access waiting for deprovisioning, was open and not in use. The new session took over that access. |

## Related topics

- [How to connect using a JIT credential](/v4-2/docs/pam-credential-how-to-connect-using-a-jit-credential)
- [How to configure a JIT credential](/v4-2/docs/pam-credential-how-to-configure-a-jit-credential-in-senhasegura)
- [Sessions for audit](/v4-2/docs/pam-session-sessions-for-audit)